Intelligence-led response: turning theory into law enforcement practice in cyber security incidents

Abstract

As the internet grows drastically in scale and density, the number of cyber security incidents investigated by law enforcement agencies (LEAs) is skyrocketing. Criminals may deny committing a crime, but LEAs are hindered in proving it by the limited processing capabilities of human analysis. While initial crime scene investigation emphasises finding actionable intelligence as quickly as possible, lab forensics focuses on reconstructing the case and cross-referencing the evidence to find the truth. Both are critical parts of the investigative response to cyber security incidents. This paper presents a practical digital forensic framework based on ISO/IEC 27043: 2015 activities, intended to handle digital evidence at the crime scene and lessen the caseload burden at the lab. By advocating an intelligence-led response to crime scene investigation and lab forensics, we aim to turn theory into practice for LEAs, supporting the resolution of cyber security incidents and the understanding of what happened. By working through the different processes and activities in practical exercises, we aim to enable LEAs to implement a response strategy for combating cyber crime.